Unbound is a caching DNS resolver that comes as a part of OpenBSD base. You can use this to provide faster as well as more secure DNS lookup for the users on your network.

Here's a sample /var/unbound/etc/unbound.conf:

        interface: # listen on localhost
        interface: # listen on to provide DNS for users on a network
        interface: ::1
        #do-ip6: no

        access-control: refuse # block all users by default
        access-control: allow # allow localhost to use unbound
        access-control: allow # allow users on your network to use unbound
        access-control: ::0/0 refuse # block all IPv6 users by default
        access-control: ::1 allow # allow IPv6 localhost to use unbound

        hide-identity: yes
        hide-version: yes

        control-enable: yes
        control-interface: /var/run/unbound.sock

        name: "."

The forward-addr lines indicate which nameserver unbound will query. You can find a list of public servers on OpenNIC.

To start unbound:

$ doas rcctl enable unbound
$ doas rcctl start unbound

For the computer that runs unbound, you'll want to make sure /etc/resolv.conf uses as the nameserver (that is, you query unbound running on port 53). In /etc/resolv.conf:

lookup file bind

Check to make sure /etc/resolv.conf.tail does not contain any other name servers except All your nameservers should instead be specified in /var/unbound/etc/unbound.conf.

If the computer running unbound uses DHCP for network configuration, you will want to include this line in /etc/dhclient.conf:

ignore domain-name-servers;

This tells OpenBSD's dhclient to ignore the name server provided by the dhcp server.

If the computer running unbound is also providing a dhcp server for your local network, you will want to add this line inside your /etc/dhcpd.conf blocks:

option domain-name-servers;